The Voice of the CISO 2022 Global Insights Report | Threat Uncertainty and a False Sense of Security

2021 was a challenging period for global Chief Information Security Officers (CISOs), with various high-profile breaches having far-reaching economic and security impacts, showing the world how vulnerable critical infrastructure and supply chains can be when targeted by cybercriminals. In 2022, CISOs once again had to reflect on the impact of the new situation on their security posture.

To gauge the mindset of cybersecurity professionals during this challenging time, Proofpoint surveyed 1,400 CISOs from around the world to produce the Voice of the CISO 2022 Global Insight Report. The report explores how CISOs are responding to an increasingly complex threat landscape, examines how people put organisations at risk, and how CISOs are shifting priorities to cope. The report also dives deep into the evolving role of the CISO and how they are meeting growing and changing demands.

▌CISO Concerns: Threat Uncertainty

48% of surveyed CISOs believe their organisation is at risk of a major cyberattack in the next year, with 1/3 of them rating the risk as very high.

In 2021, after overcoming the initial rush to deploy cloud and hybrid setups and maintain business as usual, many CISOs seemed to be able to handle corporate security with more ease, with temporary firefighting replaced by more coherent strategies, introducing new policies, training modules and technical controls for today's more distributed, cloud-reliant teams.

50% of CISOs felt unprepared for a targeted attack, a significant decrease from 66% the previous year. However, this increased confidence among some CISOs may simply be the result of overcoming certain emergencies and does not represent any tangible change in risk levels or preparedness.

There is also an unsettling disconnect between perceived risk and preparedness, which many CISOs seem to be aware of, but they are unable or unwilling to implement effective solutions because they struggle to identify which of the many common threats will actually occur.

▶ Survey Findings | What do you think is the biggest cybersecurity threat to your organisation/industry in the next 12 months?

CISOs consistently maintain the greatest concern about potential threats where there is a lack of visibility. Shifts in working models and increased reliance on the cloud have made ranking threats and establishing adequate defences exceptionally difficult. While organisations need to remain vigilant against all types of threats, it is nearly impossible to protect and train where it is needed most when security teams are unsure where the next attack will come from.

▌Human Error Creates Risk

56% of CISOs believe human error is their organisation's biggest cyber vulnerability.

After two years of remote working, the majority of CISOs trust that employees understand their role in protecting the organisation from cyber threats, with 60% of respondents agreeing or strongly agreeing with this statement.

As cyber attackers become increasingly sophisticated and systems and data become more agile and proliferate, security and business leaders must focus on priorities and partners that help simplify, reduce, manage and control an expanding attack surface and threat landscape. — Patrick Joyce, Vice President and Chief Security Officer, Medtronic

▌Remote Work and Resignations

Since enabling widespread remote working, 51% of CISOs have experienced more targeted attacks.

Hybrid and remote working have made businesses more attractive targets for cybercriminals. In addition, post-pandemic employee turnover is at an all-time high, and when employees leave, credentials and data often remain on personal devices. Regardless, this trend has left many CISOs finding it harder to protect organizational data.

▶ Survey Findings | In what way do you think employees are most likely to cause a data breach in your organisation over the next 12 months?

▌The Reign of Ransomware

Ransomware is one of the oldest tricks in the cyber attacker's playbook, but 2021 proved just how pervasive it has become. Among all attacks with an ample supply of targets, high ransom demands, and quick payouts, ransomware consistently remains undefeated.

Last year, the frequency and sophistication of these attacks increased by over 150%, making this old threat one of the biggest facing modern enterprises. The average ransom amount and maximum demands by cybercriminals doubled year-on-year in 2021.

To make matters worse, paying a ransom does not always mean the end of the matter, with half of the victims likely to suffer repeated attacks. Despite the rising stakes, many organisations seem unprepared for ransomware of any size, with around 42% of CISOs admitting they do not even have a ransomware strategy in place.

Ransomware now spreads through networks to infect systems, delete backups, and exfiltrate data, rendering traditional response strategies obsolete. As a result, some CISOs are shifting tactics, with nearly 60% of respondents now placing prevention over response.

▌The Stress of Over-Expectation

Many CISOs admit that unrealistic expectations from boards or superiors have placed them under unprecedented pressure.

Unrealistic expectations are the result of poor risk management practices. Every CISO should ensure there is an appropriate risk management approach in place to help focus the business on what matters most. CISOs cannot be expected to constantly protect the organisation from all threats. If businesses fail to mitigate risk, the board will face a greater risk of inaction. — Christian Toon, Chief Information Security Officer, Pinsent Masons

As remote and work-from-home practices become more common, IT setups are becoming increasingly complex, meaning businesses need new skills and more resources to stay secure. With employee turnover, organisations must also ensure security teams have the expertise and capability to execute cybersecurity strategies.

▶ Survey Findings | What is the top priority for the IT security department over the next two years?

Across various industries, improving information protection is the most pressing initiative for IT, technology, telecommunications, financial services, manufacturing, and the public sector.

▌Summary

With the adaptation of the past two years, many CISOs have been able to adapt to the level of risk they face. They believe employees also have a better understanding of their security responsibilities, and organisations are better equipped to deal with cyberattacks.

However, Proofpoint believes that many may have fallen into a false sense of security. Targeted attacks, ransomware, and insider threats are all on the rise.

Addressing the many issues that corporate security efforts are currently facing or will face in the near future, Security Validation provides CISOs with a comprehensive and powerful boost. The Security Metric Validation Platform simulates and restores various intrusion attack techniques on the network, helping organisations verify the effectiveness of their defensive systems, locate weak spots in their defence, and allow CISOs to focus their efforts where they are needed most to do a good job of prevention, rather than rushing to respond when threats arrive.

At the same time, during the simulated attack process, the platform can compensate for the lack of skills and experience among team members, ensuring that the response process of the security team is correct and reasonable, and training the ability of tracing and analysis, thereby properly coping with similar incidents that may occur in the future.

Fine-grained, real, and complete security validation data (including truly destructive attack actions) can be provided to various functional teams, allowing personnel at all levels to understand the current defensive status and submit corresponding reports.

Overall, CISOs seem to have viewed the first half of 2022 as a brief calm after the storm, but with rising political tensions and an increase in people-centric attacks, gaps in security awareness, preparedness, and prevention must be filled before the cybersecurity waters become choppy again.

| Source of Reference: https://www.proofpoint.com/us/resources/white-papers/voice-of-the-ciso-report